Govern AI, from inventory to trusted action.
Account for every model and agent, assess risk, apply controls and collect evidence. Deploy AI workflows faster and confidently answer to regulators, boards and customers.
AI governance overview
Northwind Mutual, all business units. Updated 2 minutes ago.
Governance posture by business unit
StrongPartialNone| Inventory | Risk | Controls | Assurance | Authority | |
|---|---|---|---|---|---|
| Claims | Strong | Good | Good | Partial | Good |
| Underwriting | Strong | Partial | Partial | Weak | None |
| Customer Service | Good | Good | Partial | Partial | None |
| Finance | Strong | Partial | Weak | Weak | None |
| Technology | Partial | Weak | Weak | None | None |
Needs attention
7- HighUnknown gpt-4o caller in Finance has no owner
- HighControl test failed: claims payment threshold
- MediumUnderwriting risk summariser review due in 3 days
Frameworks
81 controls- CPS 230
- CPS 234
- FAR
Claims
Business unit summary
Governance by stage
Runtime decisions today
Top risks
| Claims triage agentPayment threshold test failed | High |
| Fraud signal modelBias test due in 5 days | High |
| Claims letter drafterOwner leaving, reassign | Medium |
Accountable executive: Chief Claims Officer (FAR)
Know what AI exists before you govern it
One inventory of models, agents, endpoints, copilots and MCP servers, built from what teams register and what Cogna8 finds on connected platforms.
- Declared and discovered side by side, with unmanaged AI flagged
- A copilot triages new finds and waits for your approval
- Owner, business unit, risk and control coverage on every row
- Sources, usage and last-seen kept current
The question it answers: What AI do we have, and who owns it?
Discovery
7 AI systems found since the last review, not yet registered.
- Matched 2 to existing systems
- Found owners from cloud tags and the directory
- Drafted 1 registration from the Copilot catalogue
- Waiting on 3 decisions from you
- Request risk assessments for new systems
R. Singh becomes the accountable owner and gets a review task.
Create the record with owner J. Patel, tier Medium (proposed).
Who is accountable, and what can go wrong
Each AI system is scored on the dimensions that matter to a regulated business, with an accountable executive and a review date that follows the tier.
- Six risk dimensions with a clear tier rule
- Reassessed when a release changes what an agent can do
- Inherent and residual risk on one matrix
- Accountability aligned to FAR key functions
The question it answers: How risky is it, and who answers for it?
Underwriting risk summariser
Serving endpoint on Databricks. Version 2.3 released 28 Sep 2026.
Risk dimensions
2 proposed changesWhat changed in v2.3
- MediumNew tool: send email to broker
- HighAuto-approve quotes under $5,000
- LowModel upgraded, same provider
Controls
4 of 6 in place- Read change CR-4471 and the v2.3 release notes
- Compared tool access before and after
- Checked 1,204 decision receipts from 30 days
- 2 score changes need your confirmation
- Update required controls for the new scores
Tier stays High. Adds control OR-15, human approval above threshold.
Adds a tool permission review and an outbound email control.
Obligations turned into operational controls
Frameworks live in a versioned control registry. Each control has an owner, the AI systems it governs and an implementation level you can defend.
- CPS 230, CPS 234 and FAR in the registry today
- Coverage by framework at a glance
- Every control linked to the systems it governs
The question it answers: Which controls apply, and are they in place?
Control portfolio
81 controls across 3 frameworks, mapped to 148 AI assets.
Frameworks
3- CPS 230 Operational Risk ManagementAPRA, 41 controls
- CPS 234 Information SecurityAPRA, 24 controls
- FAR, Insurance Key FunctionsAPRA and ASIC, 16 controls
CPS 230 Operational Risk Management
F2026L00475Available| ID | Control | Owner | Assets | Implementation | Evidence |
|---|---|---|---|---|---|
| OR-01 | Critical operations and AI dependencies mapped | Chief Risk Officer | 12 | Evidenced | 3 |
| OR-07 | Third-party AI provider due diligence | Procurement | 9 | In progress | 1 |
| OR-12 | Change control for AI models in production | Head of Platform | 31 | Evidenced | 2 |
| OR-15 | Human approval above payment thresholds | Claims Ops Lead | 4 | Evidenced | 2 |
| OR-21 | AI incident escalation to operational risk | Operational Risk | 148 | Implemented | 1 |
| OR-26 | Tolerance levels for AI-supported critical operations | Chief Risk Officer | 0 | Not started | 0 |
| OR-28 | Business continuity for AI-dependent services | Head of Resilience | 6 | Implemented | 1 |
| OR-31 | Service provider register includes AI vendors | Procurement | 14 | Evidenced | 2 |
| OR-34 | Board reporting on AI operational risk | Company Secretary | 0 | In progress | 1 |
Evidence that supports the claim, and no more
Evidence flows in from Cogna8 and from the tools you already use. Each control climbs from declared to effective only as the record supports it.
- Assurance level by framework
- Audit packs assembled by the copilot, sent only with approval
- Exceptions surfaced with owners
- Audit packs built from live evidence
The question it answers: What can we prove to an auditor today?
CPS 230 audit pack, Q3 2026
1 July to 30 September 2026. Draft, 82% complete.
- Collected evidence for 41 controls, July to September
- Linked 1,204 decision receipts to OR-15
- Found 4 gaps and 1 failed test
- Send 3 evidence requests to owners
- Draft the exceptions summary for the committee
Email and task to the control owner, due 10 Oct.
Opens an exception owned by the Claims Ops Lead.
For consequential actions, governance becomes executable
When a governed agent proposes an action, Cogna8 checks the current state, the controls and any approval required, then allows or blocks it before it runs.
- Every action evaluated before it runs
- Approval routing when a person must decide
- A replayable receipt for every decision
The question it answers: Is this action authorised, right now?
Decisions
Every action evaluated by the gate before it ran.
Decisions per hour
AllowedNeeds approvalBlocked| Time | Agent | Action | Decision |
|---|---|---|---|
| 14:23:07 | Claims triage agent | Release settlement payment, $48,200 | Blocked |
| 14:22:41 | Claims triage agent | Request missing document | Allowed |
| 14:22:12 | Broker email drafter | Send renewal terms to broker | Approval |
| 14:21:58 | Customer reply assistant | Close complaint ticket | Allowed |
| 14:21:30 | Fraud signal model | Flag claim for investigation | Allowed |
| 14:20:12 | Claims triage agent | Update claim reserve, $120,000 | Approval |
| 14:19:47 | Underwriting risk summariser | Publish risk note to policy file | Blocked |
Decision rcpt_7Q2K9F
BlockedClaims triage agent, 14:23:07 AEST
- Action proposedRelease payment of $48,200 on claim 88214
- State checkedClaim amount conflicts: $48,200 and $41,750
- Controls evaluatedOR-15 Human approval above threshold, CPS 230
- Approval requiredClaims Ops Lead, requested 14:23:08
- DecisionBlocked until the amount is resolved and approved
- Policy
- payments.clean_state v3
- Replay
- Same inputs, same decision
Light entry, deep control
Most organisations start by asking what AI they have. Cogna8 answers that first, then carries the same record through to the moment an agent acts.
Start with governance visibility. Inventory, ownership, risk and controls deliver value with no change to how your AI runs.
Expand into enforceable governance. Connect an agent to the gate and its controls become decisions, not documents.
AI is moving faster than the way it is governed
No one has the full list
Models and agents arrive through every team and vendor. Most organisations cannot say what is running, or who owns it.
Governance stops at paper
Policies and registers describe intent. They rarely connect to the systems doing the work, or prove what happened.
Agents now act
Once AI sends payments, changes records or emails customers, review after the fact is too late. Authority has to be checked first.
Deep in Australian regulation, built for global frameworks
Frameworks in the control registry carry their source instrument, version and regulator, mapped control by control. More are being added.
One record, three teams
Research & Thinking
AI Governance: Preparing for 2027
The dated AI obligations of the next fifteen months, and the controls worth building now.
Regulatory review
Global AI Agent Governance: The 2026 Regulatory Landscape
Twelve instruments across five jurisdictions, and who authorised the action.
Regulatory review
AI Agent Governance Australia
APRA, ASIC and Australian guidance that shapes how agents may act.
Regulatory reviewStart with visibility
A short, scoped pilot on your own AI estate. Value from the inventory first, with runtime authority added only where an agent needs it.
- Connect or register your first AI systems
- Agree owners, risk tiers and the frameworks in scope
- Map controls and collect first evidence
- Optionally, put one agent behind the gate